Tag
#CWE-285
Auth.js Configuration Error Leads to Silent Fail-Open in Existence-Based Auth Checks
A critical vulnerability in Auth.js (next-auth) version 5 allows misconfigured applications to fail open, granting unauthorized access to all users when the auth layer encounters a server-side error. This issue arises from existence-based auth checks evaluating to true for every request, including unauthenticated ones, when the auth object is populated with an error. The vulnerability has a CVSS score of 9.1 and is classified under CWE-636 (Not Failing Securely) and CWE-285 (Improper Authorization).
Understanding and Defending Against Cross-Database IDOR in ArcadeDB
This educational analysis covers a critical vulnerability in ArcadeDB, a cross-database Insecure Direct Object Reference (IDOR) issue that allows unauthorized access to databases. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection strategies, and defensive measures.